CVE-2024-31496: Stack buffer overflow in CLI command
First published: Tue Nov 12 2024(Updated: )
A stack-based buffer overflow vulnerability [CWE-121] in FortiManager, FortiAnalyzer and FortiAnalyzer-BigData CLI may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAnalyzer | >=6.2.0<7.2.6 | |
| Fortinet FortiAnalyzer | >=7.4.0<7.4.3 | |
| Fortinet FortiAnalyzer BigData | >=6.2.1<7.2.8 | |
| Fortinet FortiAnalyzer BigData | =7.4.0 | |
| Fortinet FortiManager | >=6.2.0<7.2.6 | |
| Fortinet FortiManager | >=7.4.0<7.4.3 | |
| Fortinet FortiAnalyzer | >=7.4.0<=7.4.2 | |
| Fortinet FortiAnalyzer | >=7.2.0<=7.2.5 | |
| Fortinet FortiAnalyzer | >=7.0 | |
| Fortinet FortiAnalyzer | >=6.4 | |
| Fortinet FortiAnalyzer | >=6.2 | |
| Fortinet FortiAnalyzer | =. | |
| Fortinet FortiAnalyzer | =. | |
| Fortinet FortiAnalyzer | >=7.0 | |
| Fortinet FortiAnalyzer | >=6.4 | |
| Fortinet FortiAnalyzer | >=6.2 | |
| Fortinet FortiManager | >=7.4.0<=7.4.2 | |
| Fortinet FortiManager | >=7.2.0<=7.2.5 | |
| Fortinet FortiManager | >=7.0 | |
| Fortinet FortiManager | >=6.4 | |
| Fortinet FortiManager | >=6.2 |
Remedy
Please upgrade to FortiAnalyzer-BigData version 7.4.1 or above Please upgrade to FortiAnalyzer-BigData version 7.2.8 or above Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager version 7.2.6 or above Please upgrade to FortiAnalyzer version 7.4.3 or above Please upgrade to FortiAnalyzer version 7.2.6 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-31496?
CVE-2024-31496 is categorized as a critical vulnerability due to its potential for arbitrary code execution via crafted CLI requests.
How do I fix CVE-2024-31496?
To fix CVE-2024-31496, upgrade FortiManager or FortiAnalyzer to versions 7.4.3, 7.2.6, or the respective recommended versions for your software.
Which Fortinet products are affected by CVE-2024-31496?
CVE-2024-31496 affects FortiManager, FortiAnalyzer, and FortiAnalyzer-BigData across various versions.
Can an unprivileged user exploit CVE-2024-31496?
No, an attacker must have privileged access to exploit CVE-2024-31496 and execute unauthorized commands.
What type of vulnerability is CVE-2024-31496?
CVE-2024-31496 is a stack-based buffer overflow vulnerability classified under CWE-121.
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2024-31496
- agent/first-publish-date
- agent/title
- agent/remedy
- agent/references
- agent/type
- agent/description
- agent/author
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/fortiguard-psirt
- vendor/fortinet
- canonical/fortinet fortianalyzer
- version/fortinet fortianalyzer/6.2.0
- version/fortinet fortianalyzer/7.4.0
- canonical/fortinet fortianalyzer bigdata
- version/fortinet fortianalyzer bigdata/6.2.1
- version/fortinet fortianalyzer bigdata/7.4.0
- canonical/fortinet fortimanager
- version/fortinet fortimanager/6.2.0
- version/fortinet fortimanager/7.4.0
- version/fortinet fortianalyzer/7.4.2
- version/fortinet fortianalyzer/7.2.0
- version/fortinet fortianalyzer/7.2.5
- version/fortinet fortianalyzer/7.0
- version/fortinet fortianalyzer/6.4
- version/fortinet fortianalyzer/6.2
- version/fortinet fortianalyzer/.
- version/fortinet fortimanager/7.4.2
- version/fortinet fortimanager/7.2.0
- version/fortinet fortimanager/7.2.5
- version/fortinet fortimanager/7.0
- version/fortinet fortimanager/6.4
- version/fortinet fortimanager/6.2